Method for treating a defective device in a vehicle communications network

ABSTRACT

A method for handling a faulty device in a vehicle communication network is provided, which is used to identify devices that are either faulty, were removed from the vehicle communication network or were switched off, and to automatically initiate a fault-remedying measure. An expanded, device-specific driver having diagnostic functions is loaded by another device of the network to send a test signal to the faulty device. Either the faulty device is restarted or the faulty device is switched off depending on the reaction to the test signal. If a device is removed from the network, this is indicated in a database. A bus manager will inform other devices connected to the network that this device was removed from the network. Due to a classification of the individual devices connected to the network, not every device is able to perform the fault handling, but rather only suitably classified devices. Misuse is thereby prevented.

FIELD OF THE INVENTION

[0001] The present invention relates to a method for handling a faultydevice in a vehicle communication network.

BACKGROUND INFORMATION

[0002] Vehicle communication networks are used in motor vehicles,wherein individual devices which are connected to the vehiclecommunication network are controlled by drivers for these individualdevices. The drivers are managed in a database.

SUMMARY

[0003] In contrast, the method of the present invention for handling afaulty device in a vehicle communication network, wherein an automatedfault handling sets in when a device becomes defective, is switched offor is removed from the vehicle communication network. This preventsdisturbing the operation of the vehicle communication network. Afault-remedying measure appropriate to the faulty device is initiated bythe systematized procedure.

[0004] When the faulty device does not respond to a test signal, thistest signal is sent at least one more time, and if the faulty deviceagain shows no reaction, the faulty device is removed from the vehiclecommunication network by altering an entry in the database of thevehicle communication network for the faulty device in the manner thatthis faulty device is marked as removed. A signal is then optionallyalso sent to the faulty device, such that it switches itself off. Thisfurther development prevents it being checked with great probability,whether or not the device is still capable of responding to the testsignal. If it is not capable, then the vehicle communication network isable to perform no other automatic fault-handling other than to switchoff the faulty device.

[0005] Moreover, when the faulty device responds to the test signal withan error code, a restart of the faulty device is forced, and after therestart, the test signal is sent once more, and if the error code isagain sent by the faulty device as reaction to the test signal, then thefaulty device is switched off. This permits an automated fault handling,attempt being made to remove the fault by restarting the devicerecognized as faulty. If this does not help, then this device is removedfrom the vehicle communication network in the manner described above.

[0006] The bus manager may inform the other devices connected to thevehicle communication network that the faulty device was removed fromthe vehicle communication network. This rules out the other devices fromattempting to access the removed and faulty device. Malfunctions andunnecessary data traffic on the vehicle communication network arethereby avoided.

[0007] In this context, the bus manager is installed on a device of thevehicle communication network, this device also optionally being able totake over other functions besides the bus manager.

[0008] Furthermore, the individual devices connected to the vehiclecommunication network may be classified. This classification complieswith a sensitivity level which controls access to other devices. In thiscontext, it is distinguished whether a device is permitted to loaddrivers, whether a device is permitted to load device-specific andexpanded drivers, and whether a device can moreover use the drivers tohandle a fault. An unauthorized access to devices is thereby prevented.In particular, this must be seen in light of access to the communicationnetwork from outside. A vehicle communication network may have a radiointerface which permits access from outside. The classification preventsa device, which accesses the communication network from outside via theradio interface, from not having a sensitivity level that permits faulthandling. The access for a device connected to the vehicle communicationnetwork from outside may also be restricted by the classification.

[0009] Moreover, it is advantageous that devices are present which areable to perform the fault handling according to the invention, and thata device emits an error code if it is also supposed to react to a testsignal and has determined an error of its own.

BRIEF DESCRIPTION OF THE DRAWING

[0010]FIG. 1 is a schematic view of a vehicle communication network.

[0011]FIG. 2 is a method flowchart for handling a faulty device in avehicle communication network.

[0012]FIG. 3 is a fault handling flowchart for the bus manager.

[0013]FIG. 4 is a fault handling flowchart for any device of the vehiclecommunication network which is not the bus manager.

DETAILED DESCRIPTION

[0014] In the motor vehicle industry, multimedia components areincreasingly being integrated into a vehicle. In so doing, themultimedia components are frequently interconnected via a bas, thus, avehicle communication network. By the use of drivers for controllingdevices which are connected to the vehicle communication network, it ispossible that some devices that control other devices either have thesedrivers themselves or load them from a database if necessary. It isthereby possible to construct vehicle communication networks of variablecomplexity. If, at this point, a device of the vehicle communicationnetwork fails, or it is physically removed from the vehiclecommunication network or is switched off, then it must be ensured thatthe operation of the vehicle communication network continues to runnormally.

[0015] Therefore, according to the invention, a method is put forwardwith which it is possible to react to faulty behavior of a device of thevehicle communication network. By the use of an expanded,device-specific driver having diagnostic functions for a faulty device,it is determined which fault-remedying measure must be initiated in eachcase. Fault-remedying measures according to the invention are switchingoff the device or restarting the faulty device. If a device was removedphysically from the vehicle communication network, then solely the entryfor this removed device is erased from the database. Thus, in this case,there is no fault-remedying measure, rather only an adjustment of thedatabase entries. The bus manager of the vehicle communication networkinforms the other devices of the vehicle communication network about theremoval of a device. Due to a classification of the individual devicesof the vehicle communication network, it is possible that only specificdevices are able to load the expanded, device-specific driver havingdiagnostic functions in order to carry out the fault handling for thefaulty device.

[0016]FIG. 1 illustrates a vehicle communication network as a blockdiagram. A bus manager 1 is connected via a data input/output to a firstdata input/output of a control unit 2. A second data input/output ofcontrol unit 2 is linked to a bus 5. A CD player 3 and a loudspeakerwith audio amplifier 4 are in each case linked via data inputs/outputsto bus 5. All devices have bus controllers in order to transmit data viabus 5. Alternatively, it is possible for more devices to be linked tobus 5. Bus 5 here is a multimedia bus which, for example, may be theMOST (MOS transistor) bus.

[0017] In FIG. 2, the method of the present invention for handling afaulty device in a vehicle communication network is illustrated as aflowchart. In method step 6, control unit 2 controls CD player 3 andloudspeaker with audio amplifier 4. Control unit 2 is activated by thedriver or a passenger via an input device in order to cause CD player 3to play a compact disc. To that end, control unit 2 has a driver forcontrolling CD player 3. The driver has all functionalities which arepossible with CD player 3. Among them are the playback of individualtitles, storage of a group of titles which may then be played back,pause, replay or a random playback of titles one after the other. Inaddition, mechanical functions are also controllable by control unit 2,such as the insertion and ejection of the compact disc. CD player 3 hasa driver to control the loudspeaker with audio amplifier 4. The replayof the digital audio data which are loaded from the compact disc isthereby made possible.

[0018] In method step 7, CD player 3 now illustrates a malfunction, inthat it no longer reacts to a control signal from control unit 2. Forexample, such a control signal causes the title having the track number3 to be played back from the inserted CD.

[0019] In method step 8, control unit 2 recognizes this and transmits anerror message to bus manager 1. Bus manager 1 thereupon loads fromdatabase 38 an expanded, device-specific driver for CD player 3 havingdiagnostic functions. This is performed in method step 9. Therefore, busmanager 1 handles the fault. Alternatively, it is also possible forcontrol unit 2 or another unit which is linked to bus 5 as the vehiclecommunication network to handle the fault.

[0020] In method step 10, with the aid of the expanded, device-specificdriver having diagnostic functions, bus manager 1 generates a testsignal which it sends to CD player 3. In method step 11, the response tothis test signal by CD player 3 is checked. If it is a known error codewhich CD player 3 sends back to bus manager 1, then in method step 12,CD player 3 is restarted. Bus manager 1 brings this about by a knowncommand which is transmitted via bus 5. In method step 13, the testsignal is then sent again by bus manager 1 to CD player 3. In methodstep 14, the response to the repeated sending of the test signal isevaluated. If the error code is again sent by CD player 3 to bus manager1 as response to the test signal, then in method step 15, CD player 3 isswitched off by a corresponding command. In method step 16, the entryfor CD player 3 is entered as removed in database 38. Bus manager 1 thensends a message in broadcast mode to all devices connected to bus 5,with the communication that CD player 3 was removed from bus 5.

[0021] If it was established in method step 14 that CD player 3 did notrespond with an error code to the test signal, then normal operation iscommenced again in method step 17. Consequently, control unit 2 is thenable to control CD player 3 once more. Bus manager 1 then erases theexpanded, device-specific driver in order to keep its resources free.However, normal operation is only commenced in method step 17 if CDplayer 3 responds to the test signal with a correct code. If CD player 3does not respond at all, then in method step 17, CD player 3 is switchedoff, if this is possible. If this is not the case, then it must beassumed that CD player 3 was removed from vehicle communication network5. The switch-off is then also communicated by bus manager 1 to allother devices, and the corresponding entry for CD player 3 is marked asremoved in database 38.

[0022] If it was established in method step 11 that CD player 3 did notrespond with an error code to the test signal, then no error existswhich can be corrected by a restart. Therefore, in method step 18, themessage is sent by bus manager 1 to CD player 3 to switch off thedevice, in order then in method step 19 to mark the entry for CD player3 as removed in database 38. In method step 20, normal operation iscommenced, bus manager 1 informing all other devices that CD player 3 isno longer connected to bus 5. If CD player 3 does not respond to thetest signal, then it is also possible that CD player 3 was alreadyremoved from bus 5. Since the reaction to the switch-off signal from busmanager 1 to CD player 3 is not checked, this case is also covered here.Either CD player 3 is switched off according to method step 18, or it isalready switched off. The result is the same.

[0023] In FIG. 3, the fault handling by bus manager 1 is represented asa chronological sequence of transmitted messages. A controlling device21, like control unit 2 described above, sends a message 22 to device 23to be controlled, CD player 3. Device 23 to be controlled does notrespond to message 22. Therefore, an error message 25 is sent bycontrolling device 21 to bus manager 24. Bus manager 24, to which thedevice code of device 23 to be controlled was transmitted together witherror message 25, thereupon requests of database 26, using message 27,the expanded, device-specific driver having diagnostic functions fordevice 23. With message 28, this driver is transmitted from database 26to bus manager 24. In step 29, bus manager 24 performs the faulthandling presented above. With message 30, bus manager 24 transmits todatabase 26 the error report by which database 26 optionally marksdevice 23 to be controlled as removed. With message 31, bus manager 24then sends to all other devices connected to the vehicle communicationnetwork the message that device 23 was removed or that normal operationhas commenced again.

[0024]FIG. 4 illustrates how controlling device 21 itself handles thefault. The controlling device again sends message 22, to which device 23to be controlled does not react. The device to be controlled thereuponrequests from database 26 the expanded driver having diagnosticfunctions for device 23 to be controlled. With message 33, exactly thisdriver is transmitted from database 26 to controlling device 21. Inmethod step 34, the fault is then handled as presented above (FIG. 2).With message 35, an error report is transmitted to bus manager 24. Withmessage 36, bus manager 24 then transmits the corresponding error reportto database 26. Since in this example, device 23 was removed from thevehicle communication network, with message 37, all other devices areinformed that precisely this has happened. Alternatively, it is possiblethat with message 37, bus manager 24 informs the other devices thatdevice 23 is again running in normal operation.

[0025] In the following, it is described by way of example how thedevices may be classified. In this case, a corresponding sensitivitylevel is assigned to the individual devices. Those devices which cannotload any drivers and are unable to perform any fault handling belong tothe lowest sensitivity level. They are, for example, devices which cansolely be controlled and which do not perform any control functionsthemselves. The next sensitivity level has devices which can loaddrivers, these drivers being solely standard drivers, thus nodevice-specific drivers. Furthermore, these devices are also unable toperform any fault handling. In the class following next are deviceswhich are able to use and load standard drivers and device-specificdrivers, but not perform any fault handling. In the last class are thedevices having the highest sensitivity level. These devices are able toload all drivers and also handle faults. A device which accesses thevehicle communication network from outside and integrates itself intothe vehicle communication network will not receive the fault-handlingfunction, in order to avoid unauthorized accesses. For example, thiswill only be assigned to special devices which are available solely totechnicians.

What is claimed is:
 1. A method for handling a faulty device in avehicle communication network (5), devices which are linked to thevehicle communication network (5) being controlled with the aid ofdevice-specific drivers, the device-specific drivers being stored in adatabase (38) which is linked to the vehicle communication network (5),wherein when a first device reacts in a faulty manner to a signal sentby a second device, an expanded, device-specific driver havingdiagnostic functions for the first device is loaded from the database(38) by the second device or another device; with the aid of theexpanded device-specific driver, a test signal is sent to the firstdevice via the vehicle communication network (5); and a fault-remedyingmeasure is optionally initiated as a function of the reaction to thetest signal.
 2. The method as recited in claim 1, wherein when the firstdevice does not respond to the test signal, a test signal is sent atleast one more time; and when the first device again shows no reaction,as the fault-remedying measure, the first device is removed from thevehicle communication network (5) by marking the entry for the firstdevice in the database (38) as removed and optionally sending a signalto the first device to switch it off.
 3. The method as recited in claim1 or 2, wherein when the first device sends an error code as thereaction to the test signal, as the fault-remedying measure, the secondor the further device restarts the first device and optionally allfurther devices linked to the vehicle communication network (5); andwhen, after the resetting, the first device continues to send the errorcode as the reaction to the test signal, the first device is switchedoff.
 4. The method as recited in claim 2 or 3, wherein when the firstdevice is switched off, a bus manager (1) of the vehicle communicationnetwork (5) informs the remaining devices of the vehicle communicationnetwork (5) that the first device has been switched off.
 5. The methodas recited in claim 4, wherein the bus manager (1) is installed on adevice which is linked to the vehicle communication network (5).
 6. Themethod as recited in one of the preceding claims, wherein the deviceswhich are connected to the vehicle communication network (5) areclassified by assigning to each device a sensitivity level that in eachcase controls the access to other devices.
 7. A device for carrying outthe method as recited in one of claims 1 through 6, wherein the deviceloads the expanded, device-specific driver for the first device in theevent the first device reacts in a faulty manner to a received signal;with the aid of the expanded, device-specific driver, the device sendsthe test signal to the first device; and the device initiates theappropriate fault-remedying measure as a function of the reaction to thetest signal.
 8. A first device for carrying out the method as recited inone of claims 1 through 6, wherein in the event of a recognized fault,the first device sends the error code in response to the test signal.